Wind parks, which can comprise many tens of wind turbines that all feed their output into a utility grid, are generally controlled or managed by a plant controller, often referred to as a “park pilot”. The plant controller issues references or setpoints to the wind turbines of the wind Park according to the momentary requirements of the utility grid. A reference or setpoint for a wind turbine effectively controls or regulates its output. A plant controller generally comprises software running on hardware. The hardware can occasionally require replacement, for example on account of a failure. Software, on the other hand, can require updating on a more frequent basis. Reasons for updating the software might be that an error may become apparent only after a while, and such an error must be corrected. Also, software may be vulnerable to deliberate attacks such as the introduction of malware into the system. Another reason for updating software is that, over time, it may become outdated. In order to replace software that is already running in a prior art plant controller, it is necessary to halt the system while the new software is being installed. It takes time to halt a system, carry out the necessary work, and re-boot the system.
During this time, the wind turbines may be shut down, or they may be allowed to run using the previous, no longer valid, setpoints until the maintenance work has been completed. Evidently, during this time, the output of the wind park may well fail to satisfy grid code requirements. However, grid code requirements are usually very strict. These may stipulate that the output of a wind park feeding into that grid may not be interrupted, or may only be interrupted for a very brief duration, for example a few minutes at most. An “interruption” means any disabling of ancillary controls such as voltage control, frequency control or ramp control while the wind park is generating output power. Failure to meet these requirements can be associated with severe sanctions. For this reason, an operator of a wind park may be compelled to defer such updates or maintenance work. However, some defects cannot be deferred, for example a system failure on account of an error or a malware attack can occur at any unpredictable time. The ensuing unexpected downtime can result in significant loss of revenue for the operator of the wind park.